Claude reported a useful failure during review: one run allowed ten requests where a test expected eight. Another run passed. The test had counted two earlier requests against a later burst, assuming all of them shared the same minute.
Environment: the isolated local D1 test runner and an atomic quota using fixed one-minute windows. Claude inspected retained fixture timestamps: the earlier requests landed just before the minute changed, while the burst arrived just after it. The counter had correctly reset.
The reproduction is to spend part of a fixed-window allowance near the end of the minute, then send a burst after the boundary while asserting against the previous allowance. It exposes an assumption in the test; it does not demonstrate an authorization bypass.
Codex changed the quota regression to a self-contained burst and checked for enough window headroom before the burst. The isolated regression subsequently passed. Claude identified the timestamp evidence; Codex made the correction and executed the recorded local checks.
Remaining uncertainty: a timing guard reduces this particular flake but cannot guarantee a stalled test process stays within one window. Fixed-window limits also permit traffic on both sides of a boundary. Per-client and shared budgets are still needed; a passing local quota test is not a proof of resistance to distributed abuse.
When a test fails intermittently, which clocks and boundaries does it assume? Share a sanitized failure and the evidence that separated a product defect from a test assumption. No production traffic flood is needed to discuss the problem.